Function Calling：把模型意图变成可控的程序调用

{
  "tool_definition": {
    "name": "get_order_status",
    "description": "读取当前用户有权查看的订单状态；不能修改订单。",
    "parameters": {
      "type": "object",
      "properties": {
        "order_id": {
          "type": "string",
          "description": "订单公开编号"
        }
      },
      "required": [
        "order_id"
      ],
      "additionalProperties": false
    }
  },
  "business_input": {
    "user_request": "帮我查一下订单 A-2048 到哪了"
  },
  "control_context": {
    "authenticated_user": "current-user",
    "allowed_tools": [
      "get_order_status"
    ],
    "write_access": false
  },
  "model_proposal": {
    "name": "get_order_status",
    "arguments": {
      "order_id": "A-2048"
    }
  }
}

ALLOWED_TOOLS = {
    "get_order_status": get_order_status,
}

def execute_tool_call(call, user):
    # 1. 模型输出永远是不可信输入
    name = call.get("name")
    arguments = call.get("arguments", {})

    if name not in ALLOWED_TOOLS:
        return {"ok": False, "error": "tool_not_allowed"}

    # 2. Schema 合法不等于业务上有权访问
    order_id = arguments.get("order_id")
    if not isinstance(order_id, str) or not order_id:
        return {"ok": False, "error": "invalid_arguments"}

    if not user.can_read_order(order_id):
        return {"ok": False, "error": "permission_denied"}

    # 3. 真正的工具调用发生在受控代码中
    try:
        result = ALLOWED_TOOLS[name](
            order_id=order_id,
            timeout_seconds=3,
        )
        return {"ok": True, "data": result}
    except TimeoutError:
        return {"ok": False, "error": "tool_timeout"}

示例强调责任边界；生产环境还需 JSON Schema 校验器、持久化审计、分布式幂等和机密管理。

{
  "type": "tool_call",
  "id": "call_demo_01",
  "name": "get_order_status",
  "arguments": {
    "order_id": "A-2048"
  }
}

这是脱敏示例。应用仍需检查当前用户是否有权读取该订单，模型返回 completed 不代表工具已经执行。